3 Authentication and authorization logging
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2017
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 * Debug log levels for authentication logging (these both map to
23 * LOG_NOTICE in syslog)
25 #define AUTH_FAILURE_LEVEL 2
26 #define AUTH_SUCCESS_LEVEL 3
27 #define AUTHZ_SUCCESS_LEVEL 4
29 /* 5 is used for both authentication and authorization */
30 #define AUTH_ANONYMOUS_LEVEL 5
31 #define AUTHZ_ANONYMOUS_LEVEL 5
33 #define AUTHZ_JSON_TYPE "Authorization"
34 #define AUTH_JSON_TYPE "Authentication"
37 * JSON message version numbers
39 * If adding a field increment the minor version
40 * If removing or changing the format/meaning of a field
41 * increment the major version.
49 #include "../lib/tsocket/tsocket.h"
50 #include "common_auth.h"
51 #include "lib/util/util_str_escape.h"
52 #include "libcli/security/dom_sid.h"
53 #include "libcli/security/security_token.h"
54 #include "librpc/gen_ndr/server_id.h"
55 #include "source4/lib/messaging/messaging.h"
56 #include "source4/lib/messaging/irpc.h"
57 #include "lib/util/server_id_db.h"
58 #include "lib/param/param.h"
59 #include "librpc/ndr/libndr.h"
60 #include "librpc/gen_ndr/windows_event_ids.h"
61 #include "lib/audit_logging/audit_logging.h"
64 * Determine the type of the password supplied for the
65 * authorisation attempt.
68 static const char* get_password_type(const struct auth_usersupplied_info *ui);
73 #include "system/time.h"
76 * Write the json object to the debug logs.
79 static void log_json(struct imessaging_context *msg_ctx,
80 struct loadparm_context *lp_ctx,
81 struct json_object *object,
85 audit_log_json(object, debug_class, debug_level);
86 if (msg_ctx && lp_ctx && lpcfg_auth_event_notification(lp_ctx)) {
87 audit_message_send(msg_ctx,
95 * Determine the Windows logon type for the current authorisation attempt.
97 * Currently Samba only supports
99 * 2 Interactive A user logged on to this computer.
100 * 3 Network A user or computer logged on to this computer from
102 * 8 NetworkCleartext A user logged on to this computer from the network.
103 * The user's password was passed to the authentication
104 * package in its unhashed form.
107 static enum event_logon_type get_logon_type(
108 const struct auth_usersupplied_info *ui)
110 if ((ui->logon_parameters & MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED)
111 || (ui->password_state == AUTH_PASSWORD_PLAIN)) {
112 return EVT_LOGON_NETWORK_CLEAR_TEXT;
113 } else if (ui->flags & USER_INFO_INTERACTIVE_LOGON) {
114 return EVT_LOGON_INTERACTIVE;
116 return EVT_LOGON_NETWORK;
120 * Write a machine parsable json formatted authentication log entry.
122 * IF removing or changing the format/meaning of a field please update the
123 * major version number AUTH_MAJOR
125 * IF adding a new field please update the minor version number AUTH_MINOR
127 * To process the resulting log lines from the commend line use jq to
130 * grep "^ {" log file |
131 * jq -rc '"\(.timestamp)\t\(.Authentication.status)\t
132 * \(.Authentication.clientDomain)\t
133 * \(.Authentication.clientAccount)
134 * \t\(.Authentication.workstation)
135 * \t\(.Authentication.remoteAddress)
136 * \t\(.Authentication.localAddress)"'
138 static void log_authentication_event_json(
139 struct imessaging_context *msg_ctx,
140 struct loadparm_context *lp_ctx,
141 const struct timeval *start_time,
142 const struct auth_usersupplied_info *ui,
144 const char *domain_name,
145 const char *account_name,
147 enum event_id_type event_id,
150 struct json_object wrapper = json_empty_object;
151 struct json_object authentication = json_empty_object;
152 char negotiate_flags[11];
155 const char *clientDomain = ui->orig_client.domain_name ?
156 ui->orig_client.domain_name :
157 ui->client.domain_name;
158 const char *clientAccount = ui->orig_client.account_name ?
159 ui->orig_client.account_name :
160 ui->client.account_name;
162 authentication = json_new_object();
163 if (json_is_invalid(&authentication)) {
166 rc = json_add_version(&authentication, AUTH_MAJOR, AUTH_MINOR);
170 rc = json_add_int(&authentication,
180 rc = json_add_string(&authentication, "logonId", logon_id);
184 rc = json_add_int(&authentication, "logonType", get_logon_type(ui));
188 rc = json_add_string(&authentication, "status", nt_errstr(status));
192 rc = json_add_address(&authentication, "localAddress", ui->local_host);
197 json_add_address(&authentication, "remoteAddress", ui->remote_host);
201 rc = json_add_string(
202 &authentication, "serviceDescription", ui->service_description);
206 rc = json_add_string(
207 &authentication, "authDescription", ui->auth_description);
211 rc = json_add_string(
212 &authentication, "clientDomain", clientDomain);
216 rc = json_add_string(
217 &authentication, "clientAccount", clientAccount);
221 rc = json_add_string(
222 &authentication, "workstation", ui->workstation_name);
226 rc = json_add_string(&authentication, "becameAccount", account_name);
230 rc = json_add_string(&authentication, "becameDomain", domain_name);
234 rc = json_add_sid(&authentication, "becameSid", sid);
238 rc = json_add_string(
239 &authentication, "mappedAccount", ui->mapped.account_name);
243 rc = json_add_string(
244 &authentication, "mappedDomain", ui->mapped.domain_name);
248 rc = json_add_string(&authentication,
250 ui->netlogon_trust_account.computer_name);
254 rc = json_add_string(&authentication,
255 "netlogonTrustAccount",
256 ui->netlogon_trust_account.account_name);
260 snprintf(negotiate_flags,
261 sizeof( negotiate_flags),
263 ui->netlogon_trust_account.negotiate_flags);
264 rc = json_add_string(
265 &authentication, "netlogonNegotiateFlags", negotiate_flags);
269 rc = json_add_int(&authentication,
270 "netlogonSecureChannelType",
271 ui->netlogon_trust_account.secure_channel_type);
275 rc = json_add_sid(&authentication,
276 "netlogonTrustAccountSid",
277 ui->netlogon_trust_account.sid);
281 rc = json_add_string(
282 &authentication, "passwordType", get_password_type(ui));
287 wrapper = json_new_object();
288 if (json_is_invalid(&wrapper)) {
291 rc = json_add_timestamp(&wrapper);
295 rc = json_add_string(&wrapper, "type", AUTH_JSON_TYPE);
299 rc = json_add_object(&wrapper, AUTH_JSON_TYPE, &authentication);
305 * While not a general-purpose profiling solution this will
306 * assist some to determine how long NTLM and KDC
307 * authentication takes once this process can handle it. This
308 * covers transactions elsewhere but not (eg) the delay while
309 * this is waiting unread on the input socket.
311 if (start_time != NULL) {
312 struct timeval current_time = timeval_current();
313 uint64_t duration = usec_time_diff(¤t_time,
315 rc = json_add_int(&authentication, "duration", duration);
324 DBGC_AUTH_AUDIT_JSON,
330 * On a failure authentication will not have been added to wrapper so it
331 * needs to be freed to avoid a leak.
334 json_free(&authentication);
336 DBG_ERR("Failed to write authentication event JSON log message\n");
340 * Log details of a successful authorization to a service,
341 * in a machine parsable json format
343 * IF removing or changing the format/meaning of a field please update the
344 * major version number AUTHZ_MAJOR
346 * IF adding a new field please update the minor version number AUTHZ_MINOR
348 * To process the resulting log lines from the commend line use jq to
351 * grep "^ {" log_file |\
352 * jq -rc '"\(.timestamp)\t
353 * \(.Authorization.domain)\t
354 * \(.Authorization.account)\t
355 * \(.Authorization.remoteAddress)"'
358 static void log_successful_authz_event_json(
359 struct imessaging_context *msg_ctx,
360 struct loadparm_context *lp_ctx,
361 const struct tsocket_address *remote,
362 const struct tsocket_address *local,
363 const char *service_description,
364 const char *auth_type,
365 const char *transport_protection,
366 struct auth_session_info *session_info,
369 struct json_object wrapper = json_empty_object;
370 struct json_object authorization = json_empty_object;
371 char account_flags[11];
374 authorization = json_new_object();
375 if (json_is_invalid(&authorization)) {
378 rc = json_add_version(&authorization, AUTHZ_MAJOR, AUTHZ_MINOR);
382 rc = json_add_address(&authorization, "localAddress", local);
386 rc = json_add_address(&authorization, "remoteAddress", remote);
390 rc = json_add_string(
391 &authorization, "serviceDescription", service_description);
395 rc = json_add_string(&authorization, "authType", auth_type);
399 rc = json_add_string(
400 &authorization, "domain", session_info->info->domain_name);
404 rc = json_add_string(
405 &authorization, "account", session_info->info->account_name);
410 &authorization, "sid", &session_info->security_token->sids[0]);
415 &authorization, "sessionId", &session_info->unique_session_token);
419 rc = json_add_string(
420 &authorization, "logonServer", session_info->info->logon_server);
424 rc = json_add_string(
425 &authorization, "transportProtection", transport_protection);
430 snprintf(account_flags,
431 sizeof(account_flags),
433 session_info->info->acct_flags);
434 rc = json_add_string(&authorization, "accountFlags", account_flags);
439 wrapper = json_new_object();
440 if (json_is_invalid(&wrapper)) {
443 rc = json_add_timestamp(&wrapper);
447 rc = json_add_string(&wrapper, "type", AUTHZ_JSON_TYPE);
451 rc = json_add_object(&wrapper, AUTHZ_JSON_TYPE, &authorization);
459 DBGC_AUTH_AUDIT_JSON,
465 * On a failure authorization will not have been added to wrapper so it
466 * needs to be freed to avoid a leak.
469 json_free(&authorization);
471 DBG_ERR("Unable to log Authentication event JSON audit message\n");
476 static void log_no_json(struct imessaging_context *msg_ctx,
477 struct loadparm_context *lp_ctx)
479 if (msg_ctx && lp_ctx && lpcfg_auth_event_notification(lp_ctx)) {
480 static bool auth_event_logged = false;
481 if (auth_event_logged == false) {
482 auth_event_logged = true;
483 DBG_ERR("auth event notification = true but Samba was "
484 "not compiled with jansson\n");
487 static bool json_logged = false;
488 if (json_logged == false) {
490 DBG_NOTICE("JSON auth logs not available unless "
491 "compiled with jansson\n");
498 static void log_authentication_event_json(
499 struct imessaging_context *msg_ctx,
500 struct loadparm_context *lp_ctx,
501 const struct timeval *start_time,
502 const struct auth_usersupplied_info *ui,
504 const char *domain_name,
505 const char *account_name,
507 enum event_id_type event_id,
510 log_no_json(msg_ctx, lp_ctx);
514 static void log_successful_authz_event_json(
515 struct imessaging_context *msg_ctx,
516 struct loadparm_context *lp_ctx,
517 const struct tsocket_address *remote,
518 const struct tsocket_address *local,
519 const char *service_description,
520 const char *auth_type,
521 const char *transport_protection,
522 struct auth_session_info *session_info,
525 log_no_json(msg_ctx, lp_ctx);
532 * Determine the type of the password supplied for the
533 * authorisation attempt.
536 static const char* get_password_type(const struct auth_usersupplied_info *ui)
539 const char *password_type = NULL;
541 if (ui->password_type != NULL) {
542 password_type = ui->password_type;
543 } else if (ui->auth_description != NULL &&
544 strncmp("ServerAuthenticate", ui->auth_description, 18) == 0)
546 if (ui->netlogon_trust_account.negotiate_flags
547 & NETLOGON_NEG_SUPPORTS_AES) {
548 password_type = "HMAC-SHA256";
549 } else if (ui->netlogon_trust_account.negotiate_flags
550 & NETLOGON_NEG_STRONG_KEYS) {
551 password_type = "HMAC-MD5";
553 password_type = "DES";
555 } else if (ui->password_state == AUTH_PASSWORD_RESPONSE &&
556 (ui->logon_parameters & MSV1_0_ALLOW_MSVCHAPV2) &&
557 ui->password.response.nt.length == 24) {
558 password_type = "MSCHAPv2";
559 } else if ((ui->logon_parameters & MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED)
560 || (ui->password_state == AUTH_PASSWORD_PLAIN)) {
561 password_type = "Plaintext";
562 } else if (ui->password_state == AUTH_PASSWORD_HASH) {
563 password_type = "Supplied-NT-Hash";
564 } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
565 && ui->password.response.nt.length > 24) {
566 password_type = "NTLMv2";
567 } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
568 && ui->password.response.nt.length == 24) {
569 password_type = "NTLMv1";
570 } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
571 && ui->password.response.lanman.length == 24) {
572 password_type = "LANMan";
573 } else if (ui->password_state == AUTH_PASSWORD_RESPONSE
574 && ui->password.response.nt.length == 0
575 && ui->password.response.lanman.length == 0) {
576 password_type = "No-Password";
578 return password_type;
582 * Write a human readable authentication log entry.
585 static void log_authentication_event_human_readable(
586 const struct auth_usersupplied_info *ui,
588 const char *domain_name,
589 const char *account_name,
593 TALLOC_CTX *frame = NULL;
595 const char *ts = NULL; /* formatted current time */
596 char *remote = NULL; /* formatted remote host */
597 char *local = NULL; /* formatted local host */
598 char *nl = NULL; /* NETLOGON details if present */
599 char *trust_computer_name = NULL;
600 char *trust_account_name = NULL;
601 char *logon_line = NULL;
602 const char *password_type = NULL;
603 const char *clientDomain = ui->orig_client.domain_name ?
604 ui->orig_client.domain_name :
605 ui->client.domain_name;
606 const char *clientAccount = ui->orig_client.account_name ?
607 ui->orig_client.account_name :
608 ui->client.account_name;
610 frame = talloc_stackframe();
612 password_type = get_password_type(ui);
613 /* Get the current time */
614 ts = audit_get_timestamp(frame);
616 /* Only log the NETLOGON details if they are present */
617 if (ui->netlogon_trust_account.computer_name ||
618 ui->netlogon_trust_account.account_name) {
619 trust_computer_name = log_escape(frame,
620 ui->netlogon_trust_account.computer_name);
621 trust_account_name = log_escape(frame,
622 ui->netlogon_trust_account.account_name);
623 nl = talloc_asprintf(frame,
624 " NETLOGON computer [%s] trust account [%s]",
625 trust_computer_name, trust_account_name);
628 remote = tsocket_address_string(ui->remote_host, frame);
629 local = tsocket_address_string(ui->local_host, frame);
631 if (NT_STATUS_IS_OK(status)) {
632 struct dom_sid_buf sid_buf;
634 logon_line = talloc_asprintf(frame,
635 " became [%s]\\[%s] [%s].",
636 log_escape(frame, domain_name),
637 log_escape(frame, account_name),
638 dom_sid_str_buf(sid, &sid_buf));
640 logon_line = talloc_asprintf(
642 " mapped to [%s]\\[%s].",
643 log_escape(frame, ui->mapped.domain_name),
644 log_escape(frame, ui->mapped.account_name));
647 DEBUGC(DBGC_AUTH_AUDIT, debug_level,
648 ("Auth: [%s,%s] user [%s]\\[%s]"
649 " at [%s] with [%s] status [%s]"
650 " workstation [%s] remote host [%s]"
653 ui->service_description,
654 ui->auth_description,
655 log_escape(frame, clientDomain),
656 log_escape(frame, clientAccount),
660 log_escape(frame, ui->workstation_name),
671 * Log details of an authentication attempt.
672 * Successful and unsuccessful attempts are logged.
674 * NOTE: msg_ctx and lp_ctx is optional, but when supplied allows streaming the
675 * authentication events over the message bus.
677 void log_authentication_event(
678 struct imessaging_context *msg_ctx,
679 struct loadparm_context *lp_ctx,
680 const struct timeval *start_time,
681 const struct auth_usersupplied_info *ui,
683 const char *domain_name,
684 const char *account_name,
687 /* set the log level */
688 int debug_level = AUTH_FAILURE_LEVEL;
689 enum event_id_type event_id = EVT_ID_UNSUCCESSFUL_LOGON;
691 if (NT_STATUS_IS_OK(status)) {
692 debug_level = AUTH_SUCCESS_LEVEL;
693 event_id = EVT_ID_SUCCESSFUL_LOGON;
694 if (dom_sid_equal(sid, &global_sid_Anonymous)) {
695 debug_level = AUTH_ANONYMOUS_LEVEL;
699 if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT, debug_level)) {
700 log_authentication_event_human_readable(ui,
707 if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT_JSON, debug_level) ||
708 (msg_ctx && lp_ctx && lpcfg_auth_event_notification(lp_ctx))) {
709 log_authentication_event_json(msg_ctx,
725 * Log details of a successful authorization to a service,
726 * in a human readable format.
729 static void log_successful_authz_event_human_readable(
730 const struct tsocket_address *remote,
731 const struct tsocket_address *local,
732 const char *service_description,
733 const char *auth_type,
734 struct auth_session_info *session_info,
737 TALLOC_CTX *frame = NULL;
739 const char *ts = NULL; /* formatted current time */
740 char *remote_str = NULL; /* formatted remote host */
741 char *local_str = NULL; /* formatted local host */
742 struct dom_sid_buf sid_buf;
744 frame = talloc_stackframe();
746 /* Get the current time */
747 ts = audit_get_timestamp(frame);
749 remote_str = tsocket_address_string(remote, frame);
750 local_str = tsocket_address_string(local, frame);
752 DEBUGC(DBGC_AUTH_AUDIT, debug_level,
753 ("Successful AuthZ: [%s,%s] user [%s]\\[%s] [%s]"
756 " local host [%s]\n",
759 log_escape(frame, session_info->info->domain_name),
760 log_escape(frame, session_info->info->account_name),
761 dom_sid_str_buf(&session_info->security_token->sids[0],
771 * Log details of a successful authorization to a service.
773 * Only successful authorizations are logged. For clarity:
774 * - NTLM bad passwords will be recorded by log_authentication_event
775 * - Kerberos decrypt failures need to be logged in gensec_gssapi et al
777 * The service may later refuse authorization due to an ACL.
779 * NOTE: msg_ctx and lp_ctx is optional, but when supplied allows streaming the
780 * authentication events over the message bus.
782 void log_successful_authz_event(
783 struct imessaging_context *msg_ctx,
784 struct loadparm_context *lp_ctx,
785 const struct tsocket_address *remote,
786 const struct tsocket_address *local,
787 const char *service_description,
788 const char *auth_type,
789 const char *transport_protection,
790 struct auth_session_info *session_info)
792 int debug_level = AUTHZ_SUCCESS_LEVEL;
794 /* set the log level */
795 if (security_token_is_anonymous(session_info->security_token)) {
796 debug_level = AUTH_ANONYMOUS_LEVEL;
799 if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT, debug_level)) {
800 log_successful_authz_event_human_readable(remote,
807 if (CHECK_DEBUGLVLC(DBGC_AUTH_AUDIT_JSON, debug_level) ||
808 (msg_ctx && lp_ctx && lpcfg_auth_event_notification(lp_ctx))) {
809 log_successful_authz_event_json(msg_ctx, lp_ctx,
814 transport_protection,